Senior Application Security Engineer

Role Description

AlphaSense is investing in the next generation of our Application Security capability, a continuous, AI-augmented, layered defense program built for a SaaS engineering organization where AI agents and human developers ship code side by side at high velocity. As a Senior AI Application Security Engineer, you will be a senior individual contributor at the center of that program.

You will own the code and pull-request enforcement layer that every change flows through, whether authored by a human or an AI coding agent. You will define and harden the deterministic security gates that make AI-authored code auditably equivalent to human-authored code, and partner directly with engineering teams shipping AI-native and agentic features, including MCP integrations, AI coding assistants, and AI capabilities embedded in our research workflows, so those features are designed, built, and operated securely from the start.

This is a hands-on, build-it role. Not an auditor. Not a dashboard owner. We are looking for a security engineer who writes code, reads pull requests fluently across multiple languages, has personally shipped or integrated with agentic and MCP systems, and treats Application Security as a partnership with engineering rather than a gate to enforce.

You will report to the Director of Application Security within Product Security, and partner closely with our broader Security, Engineering, and GRC teams. This is a foundational hire with a clear path to Staff / Tech Lead as the team grows.

Qualifications

• 6+ years engineering experience, with 4+ in a dedicated AI Application Security / Product Security role at a SaaS or cloud-native company. Not a consulting / audit background.
• Development background, hands-on and recent.
• You write code, not just review it. You can read PRs fluently in at least two of Python, TypeScript / JavaScript, Java / Kotlin, or Go, and you are comfortable in Terraform, Helm, and Kubernetes manifests.
• Hands-on experience with agentic AI and MCP development.
• Production operation of a SAST / SCA pipeline at scale, Snyk, Semgrep, GitHub Advanced Security, Checkmarx, Veracode, or equivalent, including rule authoring, false-positive tuning, and CI/CD integration.
• Demonstrated ownership of a threat modeling or developer security training program, founder or substantial contributor.
• Layered security thinking.
• Strong written communication.

Requirements

• Own the continuous code & PR security.
• Operate and continuously tune the SAST, SCA, secrets-detection, and SBOM pipeline.
• Design, ship, and harden the deterministic security gates that make AI-authored PRs auditably equivalent to human-authored ones.
• Review human-authored and agent-authored PRs, catching the semantic violations static analysis misses.
• Drive findings to closure at the class level.
• Own how we secure AI-assisted development.
• Author and roll out our AI-Assisted Development Security policy.
• Partner with harness engineering on agent scope declarations.
• Scale the threat modeling framework.
• Partner with the product security team to build a security training program engineers actually use.
• Embed testable security acceptance criteria into the PRD template.
• Drive MTTR on critical findings under 24 hours.
• Support DAST deployment, the API pen test program, and the customer-facing security posture dashboard.
• Act as the primary technical responder for application-layer incidents.

Benefits

• Foundational hire, not a backfill.
• Genuinely novel scope.
• Build, ship, own.
• Senior IC role on a senior IC team.
• Remote-first, high autonomy, competitive compensation, performance bonus, equity, and benefits.
• Base Compensation Range: $157,000 — $216,000 USD.